Smepay
Monthly
Unauthenticated payment bypass in SMEPay: UPI Gateway for WooCommerce plugin (versions <= 1.0.5) allows remote attackers to complete WooCommerce orders without valid UPI payment by exploiting missing authorization controls. The plugin fails to enforce access checks on payment-related endpoints, enabling an unauthenticated network attacker to manipulate transaction state with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this trivially abusable on any exposed WooCommerce storefront running the affected plugin.
Unauthenticated payment bypass in SMEPay: UPI Gateway for WooCommerce plugin (versions <= 1.0.5) allows remote attackers to complete WooCommerce orders without valid UPI payment by exploiting missing authorization controls. The plugin fails to enforce access checks on payment-related endpoints, enabling an unauthenticated network attacker to manipulate transaction state with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this trivially abusable on any exposed WooCommerce storefront running the affected plugin.